boneIO black_debian_images includes a Mosquitto MQTT broker configured with default credentials that are identical across all devices and publicly documented. This allows remote attackers to gain full read and write access to the broker, enabling control over connected devices such as relays, blinds, and gates, and the injection of fake entities into linked Home Assistant installations. The issue was fixed in version 1.6.0 by generating unique MQTT passwords per device at first boot. Devices upgraded from earlier versions retain the default credentials unless manually changed.